4.1 Roles and scope
4.1.1 This agreement forms part of the Terms of business whenever Barton’s Bespoke processes personal data on behalf of a dealer or workshop customer. The customer is the Controller and Matthew Barton, trading as Barton’s Bespoke, is the Processor for Customer Personal Data processed through the back office and platform service, except where either party acts as an independent controller for its own legal or business purposes.
4.1.2 ‘Data Protection Law’ means the UK GDPR, the Data Protection Act 2018, the provisions of the Data (Use and Access) Act 2025 in force from time to time, PECR where applicable, and other binding UK data protection law applicable to the processing.
4.1.3 ‘Customer Personal Data’ means personal data for which the customer is controller and which Barton’s Bespoke processes on the customer’s behalf in providing the service.
4.2 Processing details
4.2.1 Subject matter: hosting and operation of the dealership or workshop website and back office; stock, enquiry, sales, invoicing, diary, workshop, support, backup, export and optional AI-assisted functions.
4.2.2 Duration: for the customer’s subscription and the limited retention and backup periods described in this agreement, unless law requires longer.
4.2.3 Nature and purpose: collection, recording, organisation, storage, retrieval, display, transmission, extraction, backup, restoration, support, deletion and other processing necessary to provide and secure the contracted service on documented instructions.
4.2.4 Data subjects: the dealer’s or workshop’s customers and prospects; vehicle sellers and buyers; suppliers; the customer’s staff and users; test drive participants; website visitors who submit enquiries or use interactive tools; and other individuals whose details the controller lawfully enters.
4.2.5 Personal data: names, contact details, enquiry text, vehicle and transaction details, invoice and accounting information, diary and test drive information, supplier invoice content, user, account and audit data, IP and technical data, and other information the controller chooses to enter. Special category or criminal offence data is not a routine service category and should not be entered unless expressly supported and lawfully instructed.
4.2.6 Frequency: continuous while the service is used, with nightly backup processing and user-triggered processing for optional functions.
4.3 Controller instructions and responsibilities
4.3.1 Barton’s Bespoke will process Customer Personal Data only on the customer’s documented instructions, including the instructions inherent in the customer’s use and configuration of the service, unless UK law requires other processing. If legally permitted, we will tell the customer before processing required by law.
4.3.2 The customer is responsible for the lawfulness, fairness and transparency of its collection and use of Customer Personal Data, for providing required privacy information, for having an appropriate lawful basis, and for the accuracy and relevance of the data it chooses to enter.
4.3.3 If we reasonably believe an instruction infringes Data Protection Law, we will inform the customer and may suspend the affected processing while the parties clarify the instruction.
4.4 Confidentiality and access
4.4.1 We will ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality and receive access only where needed for their role.
4.4.2 Administrative access will be restricted and used only for service delivery, support, security, restoration, compliance or another documented instruction.
4.5 Security
4.5.1 Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risk to individuals, we will maintain appropriate technical and organisational measures. These include, as appropriate: authentication and access control; least-privilege administration; encrypted transport; supplier security controls; backups and restoration capability; logging and audit controls; security updates; and processes for identifying and responding to incidents.
4.5.2 The customer is responsible for securing its own user accounts, devices and credentials, promptly removing users who no longer need access, and using the available security controls appropriately.
4.6 Sub-processors
4.6.1 The customer gives general written authorisation for Barton’s Bespoke to use the sub-processors needed to provide the service, subject to this clause.
4.6.2 The current sub-processors are: Vercel (hosting and infrastructure); Supabase (database, storage and backups); Resend (transactional email, and receipt of supplier invoices where that feature is used); Anthropic (AI processing, where an AI feature is used, including the first-reply draft written automatically when a question arrives from the customer’s website); Vehicle Data Global (vehicle history, specification and valuation lookups, where those features are used); and Stripe (payment processing, where Stripe acts as a processor for relevant personal data). The precise legal role of a supplier may vary by activity.
4.6.3 We will keep this list up to date. Before adding or replacing a sub-processor in a way that materially affects Customer Personal Data, we will give reasonable notice where practicable, so the customer can raise a reasonable data protection objection.
4.6.4 We will impose data protection obligations on a sub-processor that provide materially equivalent protection for the processing it performs, as Data Protection Law requires. We remain responsible to the customer for our processor obligations in relation to authorised sub-processing to the extent required by law.
4.7 International transfers
4.7.1 We will not make a restricted transfer of Customer Personal Data except on a lawful basis under UK Data Protection Law.
4.7.2 Where applicable, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework for an eligible recipient, the UK International Data Transfer Agreement, the UK Addendum to the approved EU standard contractual clauses, and any required transfer risk assessment.
4.7.3 The customer authorises the transfers inherent in the sub-processors listed in clause 4.6.2 and the transfer mechanisms they use.
4.8 Data subject requests and controller assistance
4.8.1 Taking account of the nature of processing, we will provide reasonable technical and organisational assistance to help the customer respond to requests exercising data subject rights.
4.8.2 If we receive a request relating to Customer Personal Data for which the customer is controller, we will normally refer the requester to the customer and notify the customer where appropriate, unless law prevents us from doing so.
4.9 Breaches, impact assessments and regulator assistance
4.9.1 We will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information reasonably available to us to help the customer meet its notification obligations.
4.9.2 Taking account of the nature of processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultation with the ICO where the customer is required to undertake them.
4.9.3 Each party will cooperate reasonably in responding to a regulator about processing covered by this agreement.
4.10 Return and deletion at the end of the service
4.10.1 During the active service, the customer can export available records through Settings. The customer should make its required exports before termination.
4.10.2 On termination, at the customer’s choice and subject to technical capability, we will return or export the available Customer Personal Data or make it available for export, and will then delete Customer Personal Data from the live service within a reasonable period, normally no later than thirty days after the end of the agreed export period, unless law requires storage.
4.10.3 Customer Personal Data already contained in routine backups may remain until that backup expires through the normal backup cycle, which is five weeks. Backup copies will remain protected and will not be restored for ordinary business use after termination, except where necessary for disaster recovery, security or legal reasons; if restored, deletion will be applied again.
4.10.4 We may retain limited information as an independent controller where required for our own tax, accounting, fraud prevention, dispute or legal obligations. That information is not retained on the customer’s processing instructions and is governed by our Privacy notice.
4.11 Information and audits
4.11.1 We will make available the information reasonably necessary to demonstrate compliance with our Article 28 processor obligations.
4.11.2 The customer may request a reasonable compliance review or audit no more than once in any twelve-month period, unless a material incident or a regulator reasonably requires more. The parties will first use available policies, certifications, supplier reports and written answers where these can reasonably demonstrate compliance.
4.11.3 Any on-site or intrusive audit must be proportionate, protect other customers’ confidentiality and system security, take place on reasonable notice during normal business hours, and avoid unnecessary disruption. The customer bears its own audit costs unless a material breach by Barton’s Bespoke is found.
4.12 Liability and order of precedence
4.12.1 The liability provisions in the Terms of business apply to this agreement to the extent permitted by Data Protection Law.
4.12.2 If this agreement conflicts with the Terms of business on the processing of Customer Personal Data, this agreement takes priority for that issue. Mandatory Data Protection Law takes priority over both.